Skip to content

Improvements to the SAR app template #343

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
sbkok merged 6 commits into from
Nov 11, 2021
Merged

Improvements to the SAR app template #343

Changes from 5 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
f039256
Improve SAR Application template
benbridts Mar 31, 2021
01464b5
Remove invalid permission
benbridts Mar 31, 2021
ae94213
Use references where possible
benbridts Mar 31, 2021
ae355d2
Merge branch 'master' into sar-app-template
sbkok Nov 8, 2021
2f18c4a
Fix use of quotes
sbkok Nov 8, 2021
06e1ded
Merge branch 'master' into sar-app-template
StewartW Nov 11, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 21 additions & 17 deletions src/template.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,20 +73,21 @@ Resources:
StringEquals:
aws:PrincipalOrgID: !GetAtt Organization.OrganizationId
Resource:
- !Sub arn:${AWS::Partition}:s3:::${BootstrapTemplatesBucket}
- !Sub arn:${AWS::Partition}:s3:::${BootstrapTemplatesBucket}/*
- !GetAtt BootstrapTemplatesBucket.Arn
- !Sub "${BootstrapTemplatesBucket.Arn}/*"
Principal:
AWS: "*"
- Action:
- s3:PutObject*
Effect: Allow
Resource:
- !Sub arn:${AWS::Partition}:s3:::${BootstrapTemplatesBucket}
- !Sub arn:${AWS::Partition}:s3:::${BootstrapTemplatesBucket}/*
- !GetAtt BootstrapTemplatesBucket.Arn
- !Sub "${BootstrapTemplatesBucket.Arn}/*"
Principal:
AWS: !Ref AWS::AccountId
BootstrapArtifactStorageBucket:
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Type: AWS::S3::Bucket
Properties:
AccessControl: BucketOwnerFullControl
Expand All @@ -104,6 +105,7 @@ Resources:
BootstrapTemplatesBucket:
Type: "AWS::S3::Bucket"
DeletionPolicy: Retain
UpdateReplacePolicy: Retain
Properties:
AccessControl: BucketOwnerFullControl
BucketEncryption:
Expand Down Expand Up @@ -177,10 +179,8 @@ Resources:
Resource: !GetAtt BootstrapTemplatesBucket.Arn
- Effect: "Allow"
Action: "s3:GetObject"
Resource: !Join
- ""
- - !GetAtt BootstrapTemplatesBucket.Arn
- "/*"
Resource:
!Sub "${BootstrapTemplatesBucket.Arn}/*"
Roles:
- !Ref LambdaRole
StackWaiterFunction:
Expand Down Expand Up @@ -346,7 +346,6 @@ Resources:
- "codecommit:List*"
- "codecommit:CancelUploadArchive"
- "codecommit:UploadArchive"
- "s3:Get"
Resource: "*"
Roles:
- !Ref CodeCommitRole
Expand Down Expand Up @@ -436,16 +435,18 @@ Resources:
- "s3:ListBucket"
- "s3:PutObject"
Resource:
- !Sub "arn:${AWS::Partition}:s3:::serverlessrepo-aws-deplo-bootstraptemplatesbucket-*"
- !Sub "arn:${AWS::Partition}:s3:::serverlessrepo-aws-deplo-bootstraptemplatesbucket-*/*"
- !GetAtt "BootstrapTemplatesBucket.Arn"
- !Sub "${BootstrapTemplatesBucket.Arn}/*"
- !GetAtt BootstrapArtifactStorageBucket.Arn
- !Sub "${BootstrapArtifactStorageBucket.Arn}/*"
- !Sub "arn:${AWS::Partition}:s3:::adf-shared-modules-*-*"
- !Sub "arn:${AWS::Partition}:s3:::adf-shared-modules-*-*/*"
- !Sub "arn:${AWS::Partition}:s3:::${SharedModulesBucket.BucketName}"
- !Sub "arn:${AWS::Partition}:s3:::${SharedModulesBucket.BucketName}/*"
- Effect: "Allow"
Action:
- "codebuild:*"
Resource:
# Hardcoded name (instead of !GetAtt CodeBuildProject.Arn)to avoid a circular dependency.
# Converting this to an inline policy can break the circle
- !Sub "arn:${AWS::Partition}:codebuild:${AWS::Region}:${AWS::AccountId}:project/aws-deployment-framework-base-templates"
- Effect: "Allow"
Action:
Expand Down Expand Up @@ -478,7 +479,7 @@ Resources:
- Name: ADF_VERSION
Value: !FindInMap ["Metadata", "ADF", "Version"]
- Name: TERMINATION_PROTECTION
Value: false
Value: "false"
- Name: PYTHONPATH
Value: "./adf-build/shared/python"
- Name: S3_BUCKET
Expand All @@ -495,7 +496,7 @@ Resources:
Name: "aws-deployment-framework-base-templates"
ServiceRole: !Ref CodeBuildRole
Source:
BuildSpec: !Sub |
BuildSpec: |
version: 0.2
phases:
install:
Expand Down Expand Up @@ -538,7 +539,7 @@ Resources:
- Name: "TemplateSource"
Configuration:
BranchName: "master"
RepositoryName: "aws-deployment-framework-bootstrap"
RepositoryName: !GetAtt CodeCommitRepository.Name
PollForSourceChanges: false
RunOrder: 1
- Name: UploadAndUpdateBaseStacks
Expand Down Expand Up @@ -888,10 +889,13 @@ Resources:
- s3:PutEncryptionConfiguration
- s3:PutBucketPolicy
- s3:PutBucketPublicAccessBlock
# This must match BucketNamePrefix of the SharedModulesBucket resource
Resource: !Sub "arn:${AWS::Partition}:s3:::adf-shared-modules-*"
- Effect: Allow
Action: ssm:GetParameter
Resource:
# Hardcoded name (instead of ${SharedModulesBucketName})to avoid a circular dependency.
# Converting this to an inline policy can break the circle
- !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/shared_modules_bucket"
- !Sub "arn:${AWS::Partition}:ssm:${AWS::Region}:${AWS::AccountId}:parameter/deployment_account_region"
FunctionName: CrossRegionBucketHandler
Expand Down Expand Up @@ -1005,7 +1009,7 @@ Resources:
detail-type:
- "CodeCommit Repository State Change"
resources:
- !Sub "arn:${AWS::Partition}:codecommit:${AWS::Region}:${AWS::AccountId}:${CodeCommitRepository.Name}"
- !GetAtt CodeCommitRepository.Arn
detail:
event:
- referenceCreated
Expand Down